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Abstract 

Over the last 25 years, a lot of work has been done on seeking for decidable non- 
regular extensions of Propositional Dynamic Logic (PDL). Only recently, an expres- 
sive extension of PDL, allowing visibly pushdown automata (VPAs) as a formalism 
to describe programs, was introduced and proven to have a satisfiability problem 
complete for deterministic double exponential time. Lately, the VPA formalism was 
extended to so called A;-phase multi-stack visibly pushdown automata (fc-MVPAs). 
Similarly to VPAs, it has been shown that the language of A;-MVPAs have desirable 
effective closure properties and that the emptiness problem is decidable. On the 
occasion of introducing /c-MVPAs, it has been asked whether the extension of PDL 
with /c-MVPAs still leads to a decidable logic. This question is answered negatively 
here. We prove that already for the extension of PDL with 2-phase MVPAs with 
two stacks satisfiability becomes Xj-complete. 

Key words: Propositional Dynamic Logic, Visibly Pushdown Automata, 
Multi-Stack Visibly Pushdown Automata, Decidability, Satisfiability 



1 Introduction 



Propositional Dynamic Logic (PDL) is a modal logic introduced by Fischer 
and Ladner [1] which allows to reason about regular programs. In PDL, there 
are two syntactic entities: formulas, built from boolean and modal operators 
and interpreted as sets of worlds of a Kripke structure; and programs, built 
from the operators test, union, composition, and Kleene star and interpreted 
as binary relations in a Kripke structure. Thence, the occuring programs can 
be seen as a regular language over an alphabet that consists of tests and 
atomic programs. However, the mere usage of regular programs limits the 
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expressiveness of PDL as for example witnessed by the set of executions of 
well-matched calls and returns of a recursive procedure, cf. [2]. Therefore, 
non- regular extensions of PDL have been studied quite extensively [2"]E?Pfo] . 
An extension of PDL by a class L of languages means that in addition to 
regular languages also languages in L may occur in modalities of formulas. 

One interesting result on PDL extensions, among many others as summa- 
rized in p], is that already the extension of PDL with the single language 
{a n bd n | n > 1} leads to an undecidable logic [3|. In contrast to this negative 
result, Harel and Raz proved that adding to PDL a single language accepted 
by a single-minded pushdown automaton yields a decidable logic [6] . A simple- 
minded pushdown automaton is a restricted pushdown automaton, where each 
input symbol determines the next control state, the stack operation and the 
stack symbol to be pushed, in case a push operation is performed. General- 
izing this concept, Alur and Madhusudan proposed in [7] visibly pushdown 
languages which are defined as languages accepted by visibly pushdown au- 
tomata (VPAs). A VPA is a pushdown automaton, where the stack operation 
is determined by the input in the following way; the alphabet is partitioned 
into letters that prompt a push, internal, or pop action, respectively. Note that 
it is well-known that visibly pushdown automata are strictly more powerful 
than simple-minded pushdown automata. Recently, also for the model of vis- 
ibly pushdown languages, a PDL extension has been investigated by Loding, 
Lutz, and Serre [I]. They proved that satisfiability of this PDL extension is 
complete for deterministic double exponential time. Note that for this result, 
every visibly pushdown language occuring in a formula must be over the same 
partition of the alphabet. 

Recently, fc-phase multi-stack visibly pushdown automata (&-MVPAs), a nat- 
ural extension of VPAs, have been introduced in [8]. A fc-MVPA is an au- 
tomaton equipped with n stacks where, again, the actions on the stacks are 
determined by the input, more precisely, every input symbol specifies on which 
stack a push or pop operation or whether an internal operation is done. More- 
over, a /c-MVPA is restricted to accept only words that can be obtained by 
concatenating at most k phases, where a phase is a sequence of input symbols 
that invoke pop actions from at most one stack. Note that A;-MVPAs with one 
stack coincide with VPAs. 

Due to the various effective closure properties and a decidable emptiness prob- 
lem of the language class described by fc-MVPAs, it is an interesting question 
to ask if the corresponding extension of PDL is still decidable. This ques- 
tion was raised in [5] and is answered negatively in this article. We prove 
E]-completeness for this PDL extension. A Sj lower bound already holds, if 
we restrict ourselves to deterministic 2-MVPAs with two stacks. This is the 
weakest possible instance of A;-MVPAs that is still more powerful than VPAs. 
Our proof relies on the same technique of the Sj-hardness proof of undecid- 
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ability of PDL extended with the single language {a n ba n \ n > 1}, which is 
presented in [2]. Note however, that {a n ba n \ n > 1} is not recognized by any 
£;-MVPA for any k. 

We proceed as follows. We recapitulate /c-MVPAs in Section [2J Section [3] in- 
troduces the extension of PDL with fc-MVPAs. A E;[-completeness proof is 
presented in Section HI 



2 &>Phase Multi-Stack Visibly Pushdown Automata 

In this section we recall the definition of &-phase multi-stack visibly pushdown 
automata from [SJ . 

Let N = {0,1,2,...} denote the natural numbers. Let n G N, then [n] = 
{1,2,..., n}. Note that [0] = 0. Let e denote the empty word. For some nGN 
an n-stack call-return alphabet is a tuple E n = ({E*, T, int ) of pairwise 

disjoint finite alphabets. Let E c = Uie[n] an d = Uie[n] f° r ever y * £ [ n ]> 
and let S = E c U E r U Ej ni . Let us fix E n for the rest of this section. 

Definition 1 A multi-stack visibly pushdown automaton (MVPA) overfl n is 
a tuple M = (Q, Qj, T, 8, Qf), where (i) Q is a finite set of states, (ii) Qj C Q 
is the set of initial states, (Hi) T is a finite stack alphabet with _L G T \ E ; 

(iv) S C (Q x E c x Q x T \ {_L}) U (Q x E r x r x Q) U (Q x E mi x Q), and 

(v) Qp C. Q is the set of final states. 

A A;- MVPA is deterministic, if \Qj\ = 1 and for each q e Q, for each a G E, 
and for each 7 6 T we have 



The set of stacks is defined as St — (T \ {-L})* ■ {_L}. A configuration of an 
MVPA is a pair (q, C) where q G Q and C : [n] — > St is a mapping. A run of 
M on an input w = a±a2 ■ ■ ■ a m G E*(m > 0), with ^ 6 S for each i G [m], is 
a sequence of configurations (go, Co)(<?i, Ci) • • • (?m, Cm) such that 

• qo ^ Qi an d Co(z) = J- for each i G [n] and 

• for every j > 1 we have, 

■ whenever aj G E* for some i £ [n], then there exists some 7 G T \ {_L} 
such that (qj-i, aj, qj, 7) G 5, and Cj(i) = 7 • Cj_i(z) and Cj(i') = Cj-\(i') 
for all i' G [n] with i f ^ i, 

■ whenever aj G E* for some z G [n], then there exists some 7 G T such that 
(qj-i,o J j, r Y,qj) G 5, and Cj(z') = Cj-i^') for all i' G [n] with i! ^ i and 



(5 n {g} x {a} x (Q x F \ {L} U {7} x Q U Q) < 1. 
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either (i) 7 = _L and Cj(i) = C 3 -_i(z) = _L or (ii) 7 7^ 1 and Cj-i(i) = 
7 • Cj(i), and 

• whenever aj G Ej n4 , then (qj-i,CLj,qj) G 5 and Cj(i) = Cy_i(i) for all 
z G [n]. 

We call a run (g , C )(gi, C\) ■ ■ ■ (q m , C m ) accepting, if q m G Qf- Furthermore, 
we denote by L(M) = {w G E* | there exists an accepting run of M on w} 
the language of M. A word w G E* is a phase, if u> G (E c U E int U E*)* for 
some z G N. For k > 1, we say a word is a k-phase if it can be obtained 
by concatenating at most k phases. 

Definition 2 y4 A;-phase multi-stack visibly pushdown automaton (k-MVPA ) 
M is a multi-stack visibly pushdown automaton that is restricted to accept 
k-phases only. Formally, we define 

L(M) = {w G E* I w is a k-phase and there exists an accepting run of M on w}. 

Note that n = implies that a fc-MVPA is as powerful as a finite state 
automaton. Moreover, we get precisely the VPAs as introduced in [7J when 
n—1. 



3 Propositional Dynamic Logic over fc-MVPAs 

Fix some countable set P of atomic propositions, and some k, n G N with k > 1. 
The set of formulas $ and the set of tests Tests of the logic PDL(A;,n) over 
some n-stack call-return alphabet E n = ({E* , E* } ie [ n ], Ej ni ) are the smallest 
sets that satisfy the following conditions: 

• true G $, 

• if p G P, then p G $, 

• if (fx, <p 2 G $, then ^V^ 2 , ""Pi G 

• if 99 G $, then 99? G Tests 

• if <p G $ and \I> C Tests is finite, then (x)<p G $, where x is either a regular 
expression over E U \I> or % is a fc-MVPA over ({E*, E*} ie [ n ], Ej ni U 

We introduce the usual abbreviations false = -itrue, <piA<p 2 = _, ( _,( Pi V-KP2), 
and = -^(x)^(p- A Kripke structure is a tuple if = (A, {^ a }aes, p), where 
A is a set of worlds, — > a C A x A is a binary relation for each a G E, and 
p : X — > 2 P assigns to each world a set of atomic propositions. For each 99 G $ 
and for each w G (E U Tests)*, define the binary relation {w}k Q -A x X and 
the set \<*p\k Q X via mutual induction as follows: 

• 1 £ ]k = {(x,x) I x G X}, 
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• if tp? G Tests, then [<^?]a: = {(x,x) \ x G X A x G 

• if a G E, then [a]^ = — > a , 

• if to G (E U Tests)* and r G E U Tests, then [iut]x = ° Ma:, 

• if p G P, then \p\k = {x E X \ p E p(x)}, 

• [<pi V <p 2 ] K = [<Pi]k U [^ 2 ]k, 
. h^] A - = X \ 

• [(x)^k = i x e X | 3t/ G X 3w G L(x) : (a;, y) G Ay E [tp] K }. 

Note that since we restrict /c-MVPAs to accept ^-phases only, we addition- 
ally allow formulas of the kind (oe)ip, where a is a regular expression over 
a finite subset of E U Tests. A &-MVPA can accept a regular language over 
fc-phases only, that is, not even E* (if E contains two pop symbols from dif- 
ferent stacks) can be recognized. However, since we would like to increase the 
expressiveness of PDL beyond regular programs, we have to explicitly take in 
regular expressions. If L is a language over a finite subset of EUTests, we define 
\L\k = UuiglI^'Ia'- In the following, we will write (L)(p ([L]<p) instead (x)^ 
([%]<£>), where L is the language of x an d X is either some regular expression 
or some &-MVPA. We also write (K, x) |= <p whenever x G \<p\k- We say that 
K is a model for ip, if (K, x) \= ip for some world x of K. We say a PDL(A;, n) 
formula (p is satisfiable, if there exists a model for (p. The satisfiability problem 
asks, given a PDL(A;, n) formula (p, whether ip is satisfiable. 

When restricting all automata that occur in a formula to be visibly push- 
down automata (i.e. over a single stack), Loding, Lutz and Serre obtained the 
following result: 

Theorem 3 ([4]) Satisfiability of PDL(1, 1) is complete for deterministic 
double exponential time. 



4 E^-Completeness of PDL(fc, n) 

For the Ti\ upper bound, we can easily adapt the proof of Proposition 9.4 
in [2] and show that every satisfiable PDL(fc, n) formula has a countable tree 
model. Thus, we can write down an existential second-order number-theoretic 
formula over N that is valid if and only if ip is satisfiable. 

For the lower bound, we prove that PDL(fc, n) is Ej-hard already for k = 2 and 
n = 2, i.e. we can restrict all occurring MVPAs to have 2 stacks and to accept 
2-phases only. For this, we reduce the E]^-hard recurring tiling problem of the 
first quadrant of the plane to satisfiability of PDL(2,2). A recurring tiling 
system T = (T, H, V, to) consists of a finite set of tile types T, a horizontal 
matching relation H C T x T, a vertical matching relation V C T x T, and 
a tile type t G T. A solution for T is a mapping /i:NxN-*T such that 
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for infinitely many m G N we have /i(0, m) = to and for all (n,m) GNxN we 
have 

• if |u(n, m) = t and //(n + 1, m) = then (t, t') G i/, and 

• if /i(n, m) = t and /i(n, m + 1) = f, then (t, t') G V. 

The recurring tiling problem is to decide whether a given recurring tiling sys- 
tem has a solution. 

Theorem 4 ([9]) TTie recurring tiling problem is ^{-complete. 

For the rest of the section fix some tiling system T = (T, H, V, to). Our goal 
is to translate T into a PDL(2,2) formula ip = <p{T) over the set of atomic 
propositions T such that T has a solution if and only if ip is satisfiable. 

Fix the 2-stack alphabet S 2 = , } ie {i j2 }, S inf ) where = {a,} and 
= for each % G [2] and where S ini = {c, d}. Define the languages Lg, 
L\~* , and Lj; for each £ G {0, 1} as follows, where wq = axb 2 and w\ = a 2 bx and 
eo = d and ei = c: 



L t = {w\ee.w[_ E \ i,j > and j ^ z+ 1}, 

= Ke^i-'/ 1 I i > 0}, 
Lj = Me £ wi^ +2 | z > 0}. 

T 

Proposition 5 For each of the languages Lg, Lf , and L\, with £ G {0, 1} 7 
there exists a deterministic 2-MVPA over H 2 that accepts it. 



PROOF. Figures [T] to [3] depict 2-MVPAs recognizing Li, and Lj, respec- 
tively, for £ = 0. The case £ = 1 is deduced by simultaneously substituting 
ax, b 2 , c, and d by a 2 , bi, d, and c, respectively. Note that all automata are 
deterministic. □ 




ai/x 



Fig. 1. A 2-MVPA recognizing L = {{a l b 2 ) i d{a 2 bx) j c \i,j > 0, j + 1}. 
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b2/±- I 0,2/x 




ai/x bi/x 



Fig. 2. A 2-MVPA recognizing = {{a&tf d(a 2 b 1 ) i+1 \ i > 0}. 



&2/-L I C12/X 




Fig. 3. An automaton recognizing Lq = {(0162)* d(a 2 bi) l+2 | i > 0}. 
Let t^snake be defined as follows: 

V^snake = (caib^a^) 2 c}tme A [Tj* c](((aib 2 )* d}txne A [L ]false) 

A [E*d](((a2&i)*c)true A [Li] false). 

A snake of a Kripke structure K is an infinite path in K that is labeled by 

c(ai6 2 ) 1 d(a 2 6i) 2 c(ai6 2 ) 3 d(a 2 6i) 4 c(a 1 6 2 ) 5 d(a 2 6 1 ) 6 c- • • . 

Proposition 6 Every model of y? S nakc « snake. 

PROOF. Let K = (X, {^ a }aes,p) be a model of </? sn akc, i- e - ( K , x ) \= ¥Wc 
for some x G X. By the first conjunct of <^ S nake; there exist worlds Xi, x 2 G X 
such that (x, Xi) G [cai^rf]^, and (xi,x 2 ) G |(a 2 &i) 2 c]^. Firstly, observe 
that (K, x 2 ) |= ((ai6 2 ) + <i)true by the third conjunct of y^snakc- This implies 
that (x 2 ,X3) G [(ai6 2 )*c?]x for some X3 G X and some i G N. But clearly 
i = 3, for otherwise (if, Xi) ^ [Lijfalse. Thus we get (x 2 ,x 3 ) G [(ai6 2 ) 3 d]_ft:. 
Symmetrically, since (if, x 3 ) |= ((a 2 &i) + c)true and (if, x 2 ) |= [L ]false by 
the second conjunct of ^ sna ke, there exists a world x 4 such that (x 3 ,x 4 ) G 
[(a 2 &i) 4 c]ft;. By repeatedly applying the above argument, it is straightforward 
to see that there exists an infinite sequence of worlds Xi, x 2 , x 3 , X4, . . . such 
that for each i > 1 we have (x 2 j_i,x 2i ) G [(a 2 &i) 2 *c]^: and also (x 2 j,x 2i+ i) G 
[(«i^2) 2 * +1 d\ K . Since additionally we have (x,xi) G ^(ai^) 1 ^], there exists 
a snake in if. □ 

Let the programs tt^ and (3 and the formula y^rccur be defined as follows: 

7r iT = {a 1 b 2 )*d(a 2 b i yc , 
(3 = tt* t (a^fo?)?^ U (a 1 6 2 )*d(a 2 6 1 )*(* ?)c^ , 
^rccur = [E*c](/3)true. 
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We call a world y on a snake a first column, if either x\ —> x^ — ^ £3 -A y or 
y A x is a subpath of cr. 

Proposition 7 Every model of y? sna k e A ^ reC ur ^os a sna&e on which infinitely 
often first column worlds satisfy the atomic proposition t . 



PROOF. Let K be a model of <^ sn ake A v^recur- By Proposition El there exists 
a snake cr in K. Fix an arbitrary world Xq on o"o such that for some xelwe 
have that x A-^ x is a subpath of cr . It is not hard to see that, by definition 
of ^ r ecur and by similar arguments as in the proof of Proposition El there exists 
a snake o\ whose initial part agrees with cxo up to world x and such that for 
some world x' Q on <7i, we have (xo,x' ) G \0\k- Moreover, by definition of (3, 
on the subpath of 0\ from x to x' there exists some first column world that 
satisfies the atomic proposition t . Fix an arbitrary world X\ on o\ such that 
there is a subpath from x' Q to X\ on o\ such that additionally for some x' G X 
we have that x' A^ %i is a subpath of o~\. Again, we have (K, x\) |= (/?)true. 
Hence again, there exists some snake 02 whose initial part agrees with o~\ up 
to X\ such that for some world x[ on <t 2 we have (xi,x[) G \0\k and on the 
subpath of cr 2 from X\ to x^ some first column world of cr 2 satisfies t . By 
repeatedly applying the same argument, we obtain a snake in K on which 
infinitely often first column worlds satisfy to- 1=1 



Let us now give a formula <^ t iie that guarantees that every (reachable) world 
contains exactly one tile type: 

Vtile = [£*] f V (* A A -(*Af) 

Next, we give a formula <^ that ensures that the types of vertically (horizon- 
tally) connected tiles satisfy the vertical (horizontal) matching relation: 

cpl = [Z*c( ai b 2 ) + ] A t - ( [L?] v f A [4] V A 
teT \ t'eT:(t,t')eH t' eT-.(t,t')eV / 

Wi) + ]At - (Wl V ^ A [L\] v f 
teT \ t'eT-.(t,t')eH V eT-.(t,t')eV 

Our final formula ip is 

V 2 = V^snake A ^ recur A lf t n e A tf]^. 

Before proving that T has a solution if and only if ip is satisfiable, we introduce 
some more notation. Let A = {(i, j) G NxN | < j < %}. We define a bijection 
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7r : N x N — > A for all (n, m) G N x N as follows 

ir(n,m) = (n + m,m). 
Thus, 7r -1 (i,j) = (i-jj) for all G A. 

Lemma 8 The recurring tiling system T has a solution if and only if cp is 
satisfiable. 



PROOF. 

only-if: Assume that T has a solution /i : N x N — > T. Figure H] depicts 
a model K = K{T) = (X, {^ a } ae s, p) that we can construct from T. To all 
those worlds that are pictured by bullets, the mapping p assigns an arbitrary 
singleton subset from T. For the worlds x^, where G A, we define 

p(x id ) = /i(7r -1 (i,j)). 

Thus, the world x it j represents the unique the pair (n, m) G N such that 
Tr(n,m) = (i,j). It is straightforward to verify that (K,x) \= ip. 

if: Let K = (X, {— > a }aes, p) be a model of <p, i.e. we have (K, x) |= y> for some 
world x G X . We prove that T has a solution. By Proposition [7] there exists 
a snake a in if on which infinitely often first column worlds satisfy the atomic 
proposition t , since both <^ sna k e as well as y? reC ur occur in tp as a conjunct and 
if is a model of (p. Recall that A = {(i,j) G N x N | < j < i}. For each 

G A, fix some world Xij on a such that x caib2 > K x 0j0 and the following 
holds for each r G N: 

da 2 b 1 , ai& 2 
X 2r ,0 >K ^2r+l,0 &na x 2r,s >K %2r,s-l 

and 

ca\bi j 0261 
^2r+l,2r+l ^2r+2,2r+2 ana ^2r+l,s *K #2r+l,s+l 

for all < s < 2r. Note that the first column nodes of a are precisely the 
nodes \x m ^ m \ m G N}. Moreover, for all (2r, s), (2r + 1, s) e Awe have 



{x 2r , s ,x 2r+1>s ) G l(a 1 b 2 ) 2r - s d(a 2 b 1 ) 2r - s+1 j K , (1) 

(x 2 , + i, s ,x 2r+2 , s ) G [(a 2 6 1 ) 2r - s+1 c(a 1 6 2 ) 2 '- s+3 ]^, (2) 

(x 2r>s ,x 2r+1>s+1 ) G [(a 1 6 2 ) 2r - s rf(a 2 6 1 ) 2 '- s+2 l / ,, (3) 

(x 2r +i, s ,x 2r+2 , s+1 ) G [(a 2 6 1 ) 2 '- s + 1 c(a 1 6 2 ) 2 '- s + 2 k. (4) 

Recall that 
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Fig. 4. Constructing a model from a solution of T. 

= {(a 1 b 2 ) t d{a 2 b 1 ) t+1 \t>0}, 

LV = {(aa&O^ai&a^l^O}, 

Lj = {(ai6 2 )*rf(a 2 bi)' +2 |t>0}, 

4 = {(a 2 6i)*c(ai6 2 )* +1 1 1 > 0}. 

Summarizing ([I]) and (|2J), we obtain for all (2r, s), (2r + 1, s) G A 



) e [ljtIjc, (5) 

(cC2r+l, S) ^2r+2,s) G [^llif- (6) 

Similarly, summarizing (j3J) and (j4]), we obtain for all (2r, s), (2r + 1, s) E A 

(z2r,*,Z2r+l,s+l) G [-^olk, ( 7 ) 

(x 2r .+i i s,a;2 f . + 2, s +i) G [mJa-- (8) 



For the rest of the proof, we show that the following mapping fi : N x N — > T 
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is a solution for T, where (n, m) G N x N: 



p(n,m) = t if {t} = p{x^ n ,m))- 

Note that p is well-defined since the formula </? t ii e guarantees that p(x n (n,m)) 
is indeed a singleton. Since each first column world on a is x m>m for some 
m G N, infinitely often first column worlds satisfy to, and ir~ l (m, m) = (0, m), 
it follows that p(0, m) = to for infinitely many m G N. 

Fix some (n,m) G N x N such that n + m is even. The case when n + m is 
odd can be handled analogously. 

Let p(n,m) = i and p(n + l,m) = £' for some t,t' G T. We prove that 
(t,t r ) G H. By definition, we have p(x 7r( „ >m) ) = {t} and /O^n+i.m)) = {£'}. 

Note that 7r(n, m) = (n + m, m) and 7r(n + 1, m) = {n + m + 1, m) and since 
n + m is even, it follows by (JSj) that 



) e (9) 

Recall that (p*_^ is defined as follows: 

vl = ix*c( ai b 2 )+} a t - ( [lj*] v f a [4] V n a 

teT \ t'eT:{t,t')eH t'eT-.(t,t')ev J 

[^*d(a 2 b 1 )+] A t -> (W] V ^ A [4] V 

teT \ t'eT-.(t,t')eH t'eT-.(t,t')eV 

By (x,x n fa m )) G [S*c(ai62) + ]ic, by ©, and by the definition of the formula 
it follows directly that (t,t') G H. 

Analogously, by applying ©, for all (n,m) GNxN such that p(n,m) = t 
and /i(n, m + 1) = t', we conclude that (t, t') &V. □ 

Finally, we obtain the following theorem: 

Theorem 9 Satisfiability of PDL(A;,n) is H\- complete. 
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